319082 - "new Bugzilla::User($uid)" allows you to pass invalid $uid

Status: RESOLVED FIXED

(Bugzilla :: Bugzilla-General, defect)

Description

[Frédéric Buclin]

new() in User.pm doesn't make sure that its parameter is a valid integer. This allows me to edit a user with ID = "1k"! Well, PostgreSQL complains, but MySQL is happy with that:

mysql> select bug_id from bugs where bug_id="1k";
+--------+
| bug_id |
+--------+
|      1 |
+--------+

Comment 1

[Frédéric Buclin]

Attachment: patch, v1

Comment 2

[Marc Schumann [:Wurblzap]]

Does this fix bug 319090, too?

Comment 3

[Max Kanat-Alexander]

Comment on attachment 204989 [details] [diff] [review]
patch, v1

I like the codce, it looks fine. But I preferred the old error message, because it gave more information.

Comment 4

[Frédéric Buclin]

Attachment: patch, v2

I'm now leaving the actual error message as is.

Comment 5

[Frédéric Buclin]

FYI, an easy way to test my patch is to go to editusers.cgi?action=edit&userid=ddd.

Comment 6

[Max Kanat-Alexander]

Comment on attachment 205554 [details] [diff] [review]
patch, v2

Yes, looks fine to me.

Comment 7

[Frédéric Buclin]

tip:

Checking in Bugzilla/User.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/User.pm,v  <--  User.pm
new revision: 1.98; previous revision: 1.97
done

2.20:

Checking in Bugzilla/User.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/User.pm,v  <--  User.pm
new revision: 1.61.2.14; previous revision: 1.61.2.13
done